Your team uses AI, but your company runs exactly as before
Monday morning, just after eight. In sales, someone drafts a quote with an AI chatbot. In service, a colleague summarises long customer emails. In purchasing, someone gets the AI to sort a supplier list. Everyone works a little faster.
The company still looks the same as always. Enquiries follow the same routes, approvals depend on the same people. Ask your management team which process AI has changed, and you will hear examples from individuals. Hardly anyone names a process that runs differently today.
You are not alone in this. In a representative Bitkom survey (Bitkom is the German digital industry association; in German) of 604 companies with 20 or more employees (March 2026), 41% say they use AI, and a further 48% are planning or discussing it. The figure doesn't show whether that use stays with individuals or changes processes.
Your employees haven't done anything wrong. They have found a tool that makes their own work easier. That is exactly where the limit lies: as long as each person decides for themselves whether and how to use AI, the benefit stays with that person. It goes on holiday with them, it leaves when they resign, and it doesn't show up in any metric.
The bottleneck lies in the organisation rather than the technology. What is missing is the company's decision to run a specific process with AI, with one owner, regulated data access and a management team that shares the risk.
The five-level model in plain language
Maturity models show where a company stands and which step comes next. Our five levels describe what happens in daily work:
- Level 1: Individual experiments. Someone tries out an AI tool because it interests them. Nobody checks whether anything comes of it.
- Level 2: AI as a personal tool. Individuals use AI regularly for drafts, summaries or research. Each person decides for themselves when and how.
- Level 3: AI firmly embedded in a business process. One specific process, such as preparing quotes, runs with AI as the binding standard. A named person owns it.
- Level 4: Several connected processes. Several such processes interlock. In part, the AI triggers work steps itself and passes results on (specialists call this agentic).
- Level 5: AI as part of the operating model. AI is part of how the company plans and delivers its services, and no longer runs as a side project.
Vendors of automation software, among others, publish models like this. In June 2026 the workflow vendor n8n presented a five-level framework. It counts from Level 0 (Awareness) to Level 4 (Transformative) and assesses each level by who uses AI, which tasks it takes on, which rules apply and how resilient the technology underneath is. Our classification is a simplified reading for mid-sized companies and does not translate theirs. The levels are cut differently, and the numbers can't be equated.
The gap between level 2 and 3: the tool becomes a process
From the outside, the step looks small. In both cases someone works with a language model. Organisationally, it is the biggest step in the whole model, because who decides changes.
At level 2, each person decides for themselves. The sales employee chooses her tool, writes her own instructions and checks the result as thoroughly as she sees fit. If something goes wrong, she corrects it, and usually nobody hears about it. The AI is a private aid, much like a personal Excel template.
At level 3, the company decides. If quote preparation runs as a fixed process with AI, the goodwill of individuals is no longer enough. Then it has to be settled who is responsible for the process, which result a person checks before it is sent and who answers for it when a wrong quote lands with the customer. That is then an operational error rather than an individual slip.
What is missing are decisions that nobody had to face at level 2. As long as AI is a private matter, each person carries their own small risk. Once it becomes part of a process, someone has to take on that risk officially. This role rarely emerges by itself.
The framework mentioned describes a related finding. About the transition from Level 2 to Level 3, it says: "This is the hardest transition in the framework, and the one where most organizations stall." The gap, it says, is "not a technology problem but an organizational one". It calls for changes in governance (from departmental guidelines to company-wide rules), infrastructure and culture (from individual champions in teams to a strategy backed by leadership). There, this break comes later than in our model, at the step from processes within individual departments to company-wide steering. Applying the reasoning to our step from level 2 to 3 is our own transfer: wherever responsibility passes from individuals to the company, the organisation is what decides.
In concrete terms, the transition depends on three hurdles: culture, because nobody owns the process; data access, because the AI only gets information through copy and paste; and backing from management, because nobody officially carries the risk.
Hurdle 1: Culture, when AI stays a private matter
A sales employee has built herself a prompt that produces draft quotes in ten minutes. A colleague in purchasing summarises supplier contracts with a chatbot. Both work. But both are stuck in a personal account, a chat history and one person's head.
The company gets little out of it. The good prompt isn't stored anywhere. Nobody knows which customer data was copied into which tool. If the employee changes jobs, the knowledge is gone.
How shadow AI comes about
Shadow AI isn't misconduct. It arises because employees want to solve a problem and the company offers no official route. So they use what is available: private accounts, free versions, the tool an acquaintance recommended.
A Bitkom survey (in German) of 604 companies with 20 or more employees from summer 2025 shows how widespread this is: a quarter know that employees use private AI tools for work, and 8% speak of widespread use. At the time, 23% of companies had fixed rules for using AI.
For management, this means two things. It can't say which information is leaving the company. And the best ideas of its people stay invisible, so they can't be transferred to other teams.
Nobody changes a process they don't own
This is where the real bottleneck lies. The employee with the quote prompt could improve the quoting process. She won't, because the process doesn't belong to her. She is not allowed to change the approval step or decide that the team will work differently in future. So she optimises her own part.
Sales management, for its part, doesn't feel responsible for the AI. It didn't introduce the tool and doesn't know the prompts. The person with the knowledge has no authority, and the person with the authority has no knowledge.
Who owns an AI workflow?
At level 3, every AI workflow needs a person in the business unit, named individually, who owns it. IT can't do this, and "everyone" ends up meaning nobody. The owner
- defines the process: which steps does the AI handle, which stay with people, where is the approval?
- maintains the work instructions, meaning prompts, templates and rules, in a shared place instead of a private chat history,
- is accountable for the result and adjusts the workflow when a quote goes out wrong,
- measures whether the process runs faster, more cleanly or more cheaply than before.
Often the person who already uses the tool best is a good fit. The difference: they get a mandate, time and the authority to change the process. Private use becomes a role.
A test for your company: for every area in which AI is used today, name the responsible person. If the answer is "everyone does it their own way", you are at level 2. Then a management decision is missing.
Hurdle 2: Data access, when the AI can't get to the right information
An AI workflow is only as good as the information it receives. If it is supposed to answer a customer enquiry, it needs the history from the CRM, the open tickets from support and the current terms from a document sitting somewhere on a drive.
At level 2, the person is the interface. The employee opens the CRM, copies three paragraphs into the chat window, adds from memory what was discussed in the last phone call and pastes the answer into the ticket. That works as long as she is there and knows which information counts. Nobody sees which data moves into which tool along the way.
At level 3, the process needs regulated access. The workflow fetches the data itself, and only the data it needs for its task. For that, someone has to decide:
- Which systems may the workflow read, and which may it change?
- Which fields are off limits, such as bank details or internal notes about people?
- Who may use the workflow, and thereby indirectly see this data?
- Who is responsible when a source is outdated or wrong?
No software answers any of these questions. Each one requires a decision, usually across departmental boundaries. If you maintain the CRM, the ticketing system and file storage separately, this is where you notice: the data silo existed before AI. AI just makes it visible.
A simple start: the three-folder principle
For the first process you don't need a new data architecture. A pragmatic start is to sort everything a workflow needs into three separate areas:
- Business context: what does the AI need to know about your company? Offering, target customers, tone, typical special cases. This rarely changes and applies to many processes.
- Data: what information does this one process work with? For example, the export of open tickets or the current contract documents. This is also where it says which source applies and how current it has to be.
- Work instructions: what should the AI do, in what order, and when does it hand over to a person? This is the written version of what today sits in the head of the person working with copy and paste.
The benefit lies less in the folders than in the clarity they force. Whoever fills them for a process has decided which data the workflow may see, where it comes from and who maintains it. And the knowledge no longer depends on individual chat histories.
Data protection: think it through now instead of postponing it
As soon as customer data flows automatically into an AI system, legal questions arise: what does the GDPR require, where is the data processed, who can access it? Settle this before the first workflow goes live. An overview of which AI is already running in the company helps here. How we build it in projects is shown in our practical check on the AI inventory. How to assess your data situation beforehand is shown in the checklist of eight data readiness questions.
Hurdle 3: Backing from management, when nobody carries the risk
If the language model delivers a weak draft at level 2, the employee corrects it herself. At level 3, a quote, a customer reply or an invoice check runs through a fixed process. As long as nobody says explicitly that the company carries the risk of this process, nobody will take it on.
Backing doesn't mean declaring AI important at the staff meeting. It consists of four decisions only management can make:
1. One prioritised process. You decide which process is switched over first, for example the pre-qualification of incoming enquiries. All other ideas wait. This protects you from ten half-finished pilots, none of which make it into day-to-day operations.
2. One owner. The owner from hurdle 1 gets the mandate officially, may change processes and reports to you.
3. A time budget. The switchover doesn't happen on the side. The owner gets fixed hours per week, and other tasks are dropped in return. We see again and again that the tool budget is the smaller item. What is scarce is the time of the people who know the process.
4. An accepted error tolerance and a yardstick. You say in advance which errors are acceptable in which phase and how you will measure success. In the first weeks, for example, a person checks every output. Later, samples are enough, and deviations are collected instead of punished. That way the owner doesn't have to fear for their position with every outlier.
If one of these points is missing, you'll see it quickly. The pilot runs, everyone finds it interesting, and after three months the team works as it did before. Nobody ever decided that the new process is the valid one. What has to be settled after the pilot for routine operation is set out in the handover checklist from pilot to routine operation.
Why technology isn't the problem
Workflow platforms connect the CRM, the ticketing system and document storage with a language model. The models can be connected via an API, a technical interface through which another system addresses the model directly, without anyone copying text into a chat window. For a first firmly embedded process, you need neither in-house development nor your own data centre.
Technical hurdles still exist, such as connecting legacy systems. But they are rarely the reason a process stays stuck at level 2. More often, what is missing is rules, coordination and integration across departmental boundaries.
More tools tend to make the problem worse: every tool a team introduces on its own creates another island with its own access, its own storage and one person who alone knows how it works. A tool zoo like this spreads responsibility out instead of bundling it, and keeps you stuck at level 2.
The question "Which tool should we use?" therefore comes too early. First, the questions from the three hurdles need answers: which process, who owns it, which data may the AI access, who approves? After that, choosing the tool is usually the smallest decision in the project.
How to tell that you have made the jump
You won't see it in the number of licences. You see it in how a process behaves when nobody pays particular attention to it. Take one specific process with AI and answer six questions with yes or no. The checkpoints come from our own work and do not come from the framework mentioned above.
1. The process keeps running when the person who introduced the tool is on holiday. What happened the last time they were away for two weeks? If quotes piled up or someone searched through other people's chat histories for the right instruction, the process depends on one person's head.
2. There is a named owner. If a complaint about an AI-supported result comes in tomorrow, whose desk does it land on? If the honest answer is "it depends", the owner is missing.
3. The process gets its data through regulated access. Where does the process get the information from the CRM, tickets and documents? If someone copies it into the chat window, the process depends on manual work, and nobody knows exactly which data flows where.
4. Approvals are documented. Is it written down what the AI may handle itself, what a person checks beforehand and who decided this? Anyone who takes over the process has to be able to look up these limits.
5. The result is measured. Which metric shows whether the process runs better than before? Handling time per case, number of queries or error rate at review. What matters is that someone looks at it regularly.
6. Management can name the benefit in one sentence. A good sentence names the process and the effect, for example: "Our draft quotes for standard enquiries are ready the same day, and sales only reviews them." If the answer stays at "our people use AI", the process is at risk the next time costs have to be cut.
Evaluation. Six yeses: this process belongs to the company, and you can tackle the next one. One to five yeses: you are in transition, and the no answers show the hurdle. Points 1 and 2 point to culture, point 3 to data access, points 4, 5 and 6 to missing backing, because approval levels, the measure of success and the mandate have to come from the top. No yeses: AI is a personal tool in your company. A normal starting point.
Do the test for each process separately. A company can be at level 3 in one area and at level 2 everywhere else. That one area then becomes the template for the next process.
The first step: one process, one owner, 30 days
You reach level 3 with one process that runs differently afterwards. An AI strategy for the whole company won't get you there. Four decisions are enough to start.
1. Choose a frequent, clearly bounded process. Well suited are processes that come up several times a week and whose result is easy to check: pre-sorting incoming enquiries, a summary of open tickets for the Monday meeting, the first draft of a quote follow-up. Rule of thumb: if you can't describe the process in five sentences, it is too big for the start.
2. Name the owner. More important than AI knowledge is that the process belongs to them in business terms and that they get time for it.
3. Set the approval level. To start with, this usually means: the AI prepares, a person approves. Write that down. Then you can loosen the level deliberately later, instead of it shifting quietly.
4. Settle data access. What information does the process need, and where is it today? If the answer is "in three tools and in a colleague's inbox", you know where the real work lies. Sort it using the three-folder principle.
Before the start, decide how you will measure success, for example by handling time saved or fewer queries. After 30 days, go through the self-test from the previous section with the owner. Even a no is a result at that point.
Which process is suitable as your first, and where are culture, data access or backing holding you back today? With our readiness checklist you can assess your starting position yourself. Would you rather talk about it directly? Then arrange a readiness call.
Frequently asked questions
What distinguishes level 2 from level 3 in AI maturity? At level 2, individuals use AI as a personal tool. At level 3, AI is built firmly into a business process, with an owner, regulated approvals and someone who answers for the result.
Why does the jump to level 3 rarely fail because of technology? Workflow platforms and language models connected via API are available. What is usually missing is ownership, regulated data access and a clear mandate from the top.
What role does management play? It prioritises one process, names the owner, frees up time and decides which errors are acceptable in the start-up phase. Without this mandate, nobody carries the risk.
Does an SME need its own data or BI team for level 3? Not for the first process. What counts there is one owner, settled data access for exactly this process and written work instructions; dedicated capacity for data quality only becomes a topic when several processes are meant to share data across departmental boundaries.
This article is not legal advice. Clarify data protection and AI Act questions case by case with your legal counsel or your data protection officer.
Sources
- n8n: AI Maturity: The 5-Level Framework (June 2026)
- Bitkom: Digitalisierung der Wirtschaft: Fast jedes Unternehmen beschäftigt sich mit KI (digitalisation of the economy: almost every company is engaging with AI; in German) (March 2026)
- Bitkom: Beschäftigte nutzen vermehrt Schatten-KI (employees increasingly use shadow AI; in German) (October 2025)